1

Commonwealth Bank

Personal

NetBanksecurityguide

2

Contents

Section

Peace of mind with NetBankWhat are the common online dangers?

Computer virusesHoax and scam emailsIdentity theftSocial networking

How do we protect you?Transactions monitored by dedicated staffNetBank website identity verificationEncrypted dataIndependent security auditsAutomatic timeout periods and password lockout

What can you do to protect yourself?Secure your computer

Optimisation checkInternet security packageUpdate your operating systemUsing Microsoft Windows Security Centre

Register for NetCodeCreate an additional loginReceive security notifications by emailReview your NetBank login and activity log

What should you do now?NetBank security checklist

Understanding the security features of your browserInternet Explorer 7 (Microsoft Windows)Firefox 3 (Microsoft Windows, Apple Mac OS X)Safari 3.2 (Microsoft Windows, Apple Mac OS X)

Page

45557799911121213131314141416161617181819192021

3

Further informationNetBank

Register for NetBankLearn more about NetCode SMS and registerSecurity Centre

Internet security packagesFurther online security information

Protect Your Financial IdentityStay Smart OnlineNetAlertScam Watch

Page

2222222222222424242424

Contents

Section

4

Peace of mind with NetBank

The internet has changed the way millions of Australians communicate, share

information, shop, and do everyday banking. With 24/7 access from around the world

you can view balances, transfer funds and lots more at your convenience using NetBank

– Australia’s most popular online banking service.

The Commonwealth Bank is committed to keeping you safe online and uses state of

the art fraud prevention and detection technology, monitored around the clock by a

dedicated team, to actively protect your finances and confidential information.

You also have an important role to play in security. By taking the simple measures

outlined in this guide to protect yourself online you’ll enjoy peace of mind when using

the internet and NetBank.

The safety of your money is 100% guaranteed.This means we’ll cover any loss should someone make an

unauthorised transaction on your account using NetBank

– provided you protect your Client number and Password,

and immediately notify us of the loss, theft or misuse of your

password and of any suspicious activity on your account.

5

What are the common online dangers?

Computer viruses

As the internet has grown in popularity, cyber-criminals have seen an opportunity to prey

on unwary users for financial gain.

Using Computer Viruses and Trojans, they target and infect unprotected computers to

gain access to logins and passwords as you surf the internet. These Viruses often record

key strokes, mouse clicks or take a snapshot of your screen without your knowledge,

when you visit secure sites that require your credentials and send this information to the

waiting cyber-criminals.

Computer viruses are usually spread through email attachments (including URL links

to websites), which might appear to be sent by a friend or trusted source, and files

downloaded from the internet.

Every computer used to access NetBank needs an internet

security package installed to protect you from viruses. Learn

more about internet security packages on page 13.

Hoax and scam emails

Emails are a great way to stay in touch with friends and family. Unfortunately, criminals

also use the popularity of email to target unsuspecting customers with fake messages

asking for their personal details or money.

Tip

6

Hoax emails, commonly referred to as phishing, can appear to be from the

Commonwealth Bank and ask you to update or confirm details such as:

4NetBank client number

4NetBank password

4Personal identification questions

4Contact details

4Account numbers

The Commonwealth Bank will never send you an email asking you to confirm, update

or reveal your confidential banking information. You can see an example of a hoax

email below:

Please send suspected hoax emails as an attachment to hoax@cba.com.au. If you have

responded to a hoax email, call the NetBank Help Desk immediately on 13 2221 and

select option 4 (24 hours a day, 7 days a week).

7

Scam emails promise a quick and easy way to earn large amounts of money. There’s a

range of different scam emails, with new ones appearing all the time, but the examples

below outline the main types:

‘Nigerian 419’ scams promise huge financial rewards if you help someone transfer

money out of their country by paying fees or giving them your bank account details.

Up-front payment scams ask you to send money upfront for a product or ‘reward’.You’ll

end up with something much less than you expected or more than likely nothing at all.

Transferring money for someone else is basically letting criminals use your bank

account to ‘launder’ their dirty money – this is illegal and you may be prosecuted.

Scam emails appear too good to be true – and that’s because they are!

Identity theft

Identity theft occurs when criminals use your personal information for profit – by applying

for credit, running up bills and not paying creditors – while pretending to be you.

These criminals use viruses, hoax emails and social networking sites (described below)

to gather information needed to ‘steal’ your identity like your name, credit card details,

address, date of birth, bank account, debit card details and driver’s licence, and then

commit fraud in your name.

Social networking

Social networking sites, such as Facebook, MySpace and LinkedIn, are online

communities of people who share interests and activities and offer a range of ways to

connect and communicate with other people. Unfortunately they also offer criminals

another way to gather information for identity theft.

Tip

8

To protect yourself while using these social networking sites:

4Make sure your profile pages can only be accessed by people you trust, and not

the general public, by changing the security settings

4Never publish personal or sensitive information such as your birthday, driver’s

licence number, tax file number or bank account details

4Don’t publish contact details such as your home address or phone number

NetCode is a highly effective and convenient authentication

system requiring passwords you only use once to authorise

certain NetBank activities and transactions. Learn more

about this free service and how it can protect you on page 16.

Tip

9

How do we protect you?The Commonwealth Bank takes the security of your money and personal information

very seriously. We’re a leader in online banking security and are committed to providing

you with the most secure banking environment possible. Our key security measures

include:

Transactions monitored by dedicated staff

We have dedicated security staff who use advanced monitoring software to identify

potentially fraudulent activity when it occurs and take necessary preventative action until

we can establish whether the activity is genuine or not.

Our security staff also work closely with law enforcement agencies including the

Australian Federal Police and Australian High Tech Crime Centre (AHTCC) to fight online

crime.

Our transaction monitoring, which is industry-leading, is backed up by the NetBank Help

Desk, available on 13 2221 option 4 (24 hours a day, 7 days a week).

NetBank website identity verification

When the address bar in your web browser turns green, it means the website you are

visiting has an Extended Validation certificate.

NetBank has attained the highest level Extended Validation certificate through an

extensive independent audit by VeriSign – the leading internet identity verification

organisation based in the United States. The green address bar displaying

‘Commonwealth Bank of Australia (AU)’ is a clear visual sign you have reached the

genuine NetBank website and your session is protected with encryption.

Browsers that support Extended Validation certificates include:

4Internet Explorer 7

4Firefox 3

4Safari 3.2

4Google Chrome

10

The green Site Identity Button tells you that the site has fully verified identity information about the owner (in this case the Commonwealth Bank of Australia) and that the connection is encrypted.

The ‘https’ in the web address tells you that you are using SSL encryption (SSL is short for Secure Sockets Layer and was developed to transmit private data via the internet). The ‘commbank.com.au’ before the forward slash tells you that you are using a Commonwealth Bank website.

The yellow lock means that there is an encrypted connection.

11

Encrypted data

All information sent between NetBank and your computer is encrypted which means

the information is unreadable to anyone but you. The encryption technology ensures

confidentiality and gives you peace of mind. A padlock symbol is displayed on your web

browser to let you know you are viewing a secure web page.

Where is the security padlock?

Internet Explorer 6 - at the bottom right of the screen

Internet Explorer 7 - at the top right of the address bar

Firefox 3 - at the bottom left of the screen

Safari 3 - at the top right hand corner of the screen

12

You can also tell if you are viewing a secure web page by looking at the text before the

website name at the top of your browser, in the address bar. When you see ‘https’ you

can be assured the page is secure.

Independent security audits

Commonwealth Bank regularly employs independent security consultants to confirm

the security of our systems. The work undertaken includes reviews of areas such as

architecture, firewall configurations (a firewall prevents unauthorised access to computer

networks), the security of our web server and the security of the different applications on

our site.

Automatic timeout periods and password lockout

If you’re logged in to NetBank but haven’t been using it for a certain period of time,

NetBank will automatically log you out to reduce the risk of anyone else accessing your

banking details if you leave your computer unattended.

If someone does try to guess your password, your account will be locked after a set

number of unsuccessful attempts. This protects you against criminals trying to guess

your password.

13

What can you do to protect yourself?While we take every available security precaution to protect your money and confidential

information, there are also a number of important steps you should take to protect

yourself from online threats such as viruses and identity theft. Below are five key steps

to using NetBank and the internet safely:

1. Secure your computer

To use the internet safely first you need to make sure your computer is secure. Taking

the steps below to protect your computer not only saves you time and trouble if

something goes wrong but also ensures that you are getting the best online experience.

Optimisation Check

To ensure you get the best out of NetBank, the Commonwealth Bank offers a simple

check to see which web browser, operating system and browser settings you have. If

your computer isn’t optimised for NetBank, we’ll provide some recommendations on

how you can improve your NetBank experience.

You can access the Optimisation Check directly from the NetBank login page.

14

Internet security package

Every computer used to access NetBank needs an internet security package installed

which will protect you from viruses and keep your online identity safe. The package from

a reputable retailer should include:

4Anti-virus – stops viruses from damaging your computer

4Anti-spyware – protects your computer from viruses that try to monitor what

you’re doing online

4Firewall – monitors information going in and out of your computer to stop

unauthorised access

It’s important to make sure the internet security package is set to automatically

download the daily antivirus updates so you’re protected against the latest threats.

For your convenience, a list of popular internet security packages can be found in the

‘Further Information’ section on page 22.

Update your operating system

The operating system is the program that controls the normal functions of your

computer. Ensuring your operating system stays up-to-date is an important step in

keeping your computer secure. Both Microsoft and Apple regularly release updates, or

patches, that provide new features, improve performance and protect against new types

of viruses.

4Microsoft Windows – use Windows Update (http://windowsupdate.microsoft.

com/)

4Apple Mac OS X – use Software Update within Finder

Updates are normally released every month but there may be urgent security patches

during the month. You can set your computer to automatically download and install

updates.

Using Microsoft Windows Security Centre

For users of the Microsoft Windows operating system, the Security Center can help you

take control of security on your computer by showing you all the security related settings

on one convenient screen.

It will alert you when security software is out of date or when security settings need to be

strengthened, ensuring your computer is set up for you to use NetBank and the internet

15

safely. The example below shows an antivirus program is not installed and provides a

‘Find a program’ link to fix this security problem.

You can access the Windows Security Center by clicking on

Start > Control Panel > Security Center.

16

2. Register for NetCode

NetCode SMS offers you another layer of protection against fraud and identity theft.

It’s a highly effective and convenient system requiring passwords you only use once to

authorise certain NetBank activities and transactions. The single-use password is sent to

your mobile phone via an SMS message and only remains valid for 30 seconds.

Gaining access to most secure sites relies on ‘something you know’ such as a password

or security questions. By adding a second layer of security requiring ‘something you

have’ such as a mobile phone, you’re protected from online threats like viruses and

identity theft. With the NetCode SMS single-use password sent straight to your mobile

phone, criminals can’t authorise any fraudulent transactions.

3. Create an additional login

By creating an additional login you can tailor your level of NetBank access for those

times you are using a computer that is not your own.

Before you access NetBank from public or shared computers you can create an

additional login with ‘view only’ access – this means you can view balances and your

transaction history but you can’t perform new transactions. This gives you peace of

mind if you have to use unsecured computers at places like internet cafes or public

libraries.

Visit NetBank to view our demo to see how quick and easy it is to create an additional

login.

4. Receive security notifications by email

Security notifications are sent out as a secure bank message in NetBank.

You can also elect to receive these messages as an email.

If you didn’t perform the activity, immediately call the NetBank Help Desk on 13 2221

and select option 4 (24 hours a day, 7 days a week).

17

Make sure you receive these important messages and keep your email address up-to-

date. If you need to update your email address, login to NetBank, then click on the ‘My

contact details’ option under the ‘Profile and preferences’ tab.

5. Review your NetBank login and activity log

NetBank keeps a record of your access and activity on your account for your peace of

mind. The first screen you’ll see after a successful login shows the date and time of your

last login.

Also, you can view the full history of your activity by going to the ‘Security’ tab, then

selecting ‘Online history’.

If you notice any unusual activity, immediately let the NetBank Help Desk know on

13 2221 and select option 4 (24 hours a day, 7 days a week).

18

What should you do now?

NetBank security checklist

Run an internet security package (anti-virus, anti-spyware, firewall).

See page 13 for more information.

Enable automatic updates for your operating system. See page 14

for more information.

Register for NetCode – FREE security enhancement. See page 16

for more information.

Login to NetBank directly from commbank.com.au Do not access

NetBank via links from other sites.

Confirm the authenticity of Bank emails via the ‘Bank Messages’

inbox in NetBank.

Regularly change your NetBank password and personal identification questions.

Keep your contact details up-to-date.

Report any suspicious activity on your account immediately to the NetBank Help

Desk on 13 2221 and select option 4 (24 hours a day, 7 days a week).

Always logout of NetBank using the button located at the top right

of the screen.

Run our optimisation check to ensure you are getting the best

NetBank experience.

19

Understanding the security features of your browser

Internet Explorer 7 (Microsoft Windows)

If you are using IE7 on Windows XP, the phishing filter (a filter for hoax emails) and/or

certificate revocation is needed to enable the address bar to turn green when on a site

that uses extended validation certificates (this means you can be sure a site is genuine):

4To turn on the phishing filter (this would be turned on by default) click on Tools >

Phishing Filter > Turn On Automatic Website Checking

4To turn on certificate revocation (this would be turned off by default), click on

Tools > Internet Options > Advanced. Scroll down to ‘Security’ and tick

Check for Server Certificate Revocation. Note that this requires a restart of the

browser to take effect.

The ‘https’ in the web address tells you that you are using SSL (SSL is short for Secure Sockets Layer and was developed to transmit private data via the internet) encryption. The ‘commbank.com.au’ before the forward slash tells you that you are using a Commonwealth Bank website.

The green shade means that the cerfiticate uses extended validation. This means that the communication between your browser and the website is encrypted and that the certification authority has confirmed that the website is owned or operated by a business that is legally organised under the jurisdiction shown in the cerfificate and on this status bar.

The yellow lock indicates that you are using an encrypted connection. The name of the organisation that owns the SSL certificate (in this case, the Commonwealth Bank of Australia) is also displayed. If you click on the lock and select ‘View Certificate’ you will see information about the certifying authority and the contents of the certificate.

20

Firefox 3 (Microsoft Windows, Apple Mac OS X)

The green Site Identity Button tells you that the site has fully verified identity information about the owner (in this case the Commonwealth Bank of Australia) and that the connection is encrypted.

The ‘https’ in the web address tells you that you are using SSL (SSL is short for Secure Sockets Layer and was developed to transmit private data via the internet) encryption. The ‘commbank.com.au’ before the forward slash tells you that you are using a Commonwealth Bank website.

The yellow lock means that there is an encrypted connection.

21

Safari 3.2 (Microsoft Windows, Apple Mac OS X)

The lock symbol and the green identity indicator tells you that the website’s ownership has been verified with a certificate and that any information entered will be encrypted.

22

Further information

NetBank

Register for NetBank:

http://www.commbank.com.au/personal/netbank/default.aspx

NetCode SMS demo:

http://www.commbank.com.au/personal/netbank/learn-about-netbank/demos/security/

netcodesms_step1.aspx

Security Centre:

http://www.commbank.com.au/security-privacy/

Internet security packages:

Popular internet security packages for Windows include:

4CA: http://www.ca-store.com.au

4Checkpoint: http://www.checkpoint.com/products/za_iss/index.html

4F-Secure: http://www.f-secure.com/estore/aus/

4McAfee (Internet Security): http://au.mcafee.com/

4Symantec: http://shop.symantecstore.com/store/symnahho/DisplayHomePage

4Trend Micro: http://www.trendmicro.com.au/au/products/personal/index.html

The commercial market for internet security packages for Macintosh systems is less

mature, however some packages are available:

4ClamXav: http://www.clamxav.com

4McAfee (Virex): http://www.mcafee.com/au/small/products/virusscan_for_mac/

virusscan_for_mac.html

4SecureMac: http://securemac.macscan.com

4Virus Barrier: http://www.intego.com/virusbarrier/

23

These sites are listed for your general information only. The Commonwealth Bank does

not endorse any of the services, products or solutions provided by these companies

and does not accept any liability for any loss or damage you may suffer arising out of

or associated with your choice of any service, product or solution provided by these

companies. You should seek independent expert advice if you have any concerns

regarding what services, products or solutions may be suitable for you.

Configure your package so that it automatically scans (at a minimum):

4Incoming and outgoing email and attachments

4Files as they are opened

4Your entire disk, at least monthly

4Preferably other services, if possible, such as web traffic and instant messaging

Most high quality commercial software packages, like those listed above, provide easy-

to-use, intuitive “consoles” for the home user. They are generally preconfigured to

provide an optimum level of security, and options are easily selected using ‘tick boxes’

or ‘radio buttons’.

Maintain your internet security package by:

4Updating the software every year or two

4Updating the signatures* often (e.g. every few days) — this should happen

automatically with most packages

* Most anti-virus or internet security software packages are updated on an hourly or

daily basis by the vendor. This ensures that the software package is able to identify the

latest threats. This update process usually occurs automatically but it is configurable by

the user. Note that this is not the same as updating the version of your software (e.g.

changing from a 2006 version to a 2008 version).

24

Further online security information

Protect Your Financial Identity A joint initiative between the Australian Bankers Association, Australian High Tech Crime

Centre and Australian Securities & Investments Commission

http://www.protectfinancialid.org.au/

Stay Smart Online

An Australian Government initiative

www.staysmartonline.gov.au

NetAlert

An Australian Government initiative

www.netalert.gov.au

Scam Watch

An Australian Competition & Consumer Commission initiative

www.scamwatch.gov.au